Analysis
-
max time kernel
135s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
26-10-2023 22:33
Behavioral task
behavioral1
Sample
NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe
-
Size
92KB
-
MD5
fe66ab5f04442c4cdc95bf3ac05183b0
-
SHA1
6e66dc054e53ba8cc4d467eab8f663d79bcc3ccf
-
SHA256
f6ff6b60a49cf3610da6921b2735d4b14b30e62a2abc291d3404342863d497bb
-
SHA512
2135bda00db36baa2f2b66092293cdf9ecf32a7378d1d9894aa9b45ac1ccc5e8676f1106d56c2f54c2e84420bfda5b3765ff64b0de4f44e395abf4dbf58aa7f9
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr/:9bfVk29te2jqxCEtg30Bz
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2912 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2504 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exeAdobeUpdate.exepid process 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe 2504 AdobeUpdate.exe 2504 AdobeUpdate.exe 2504 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exedescription pid process Token: SeIncBasePriorityPrivilege 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.execmd.exedescription pid process target process PID 840 wrote to memory of 2504 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe AdobeUpdate.exe PID 840 wrote to memory of 2504 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe AdobeUpdate.exe PID 840 wrote to memory of 2504 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe AdobeUpdate.exe PID 840 wrote to memory of 2504 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe AdobeUpdate.exe PID 840 wrote to memory of 2504 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe AdobeUpdate.exe PID 840 wrote to memory of 2504 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe AdobeUpdate.exe PID 840 wrote to memory of 2504 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe AdobeUpdate.exe PID 840 wrote to memory of 2912 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe cmd.exe PID 840 wrote to memory of 2912 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe cmd.exe PID 840 wrote to memory of 2912 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe cmd.exe PID 840 wrote to memory of 2912 840 NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe cmd.exe PID 2912 wrote to memory of 2716 2912 cmd.exe PING.EXE PID 2912 wrote to memory of 2716 2912 cmd.exe PING.EXE PID 2912 wrote to memory of 2716 2912 cmd.exe PING.EXE PID 2912 wrote to memory of 2716 2912 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.fe66ab5f04442c4cdc95bf3ac05183b0_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD554a135d28b06e59bce3f7f25f053312d
SHA1613156aa89a91727266dc725d06286f582e6d91a
SHA2568f5dfc2121938aae37986a08d36e7556276012122d3312a95ca74023e00d453d
SHA5129f74a6062d30a11c0879929dbe757645f3e207f1ca37a2d31e07b32f856f8568061e51bf2deaa831d9777e579d83a541a79689c990be5d8ecdf4bfe5d2fcf28b
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD554a135d28b06e59bce3f7f25f053312d
SHA1613156aa89a91727266dc725d06286f582e6d91a
SHA2568f5dfc2121938aae37986a08d36e7556276012122d3312a95ca74023e00d453d
SHA5129f74a6062d30a11c0879929dbe757645f3e207f1ca37a2d31e07b32f856f8568061e51bf2deaa831d9777e579d83a541a79689c990be5d8ecdf4bfe5d2fcf28b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD554a135d28b06e59bce3f7f25f053312d
SHA1613156aa89a91727266dc725d06286f582e6d91a
SHA2568f5dfc2121938aae37986a08d36e7556276012122d3312a95ca74023e00d453d
SHA5129f74a6062d30a11c0879929dbe757645f3e207f1ca37a2d31e07b32f856f8568061e51bf2deaa831d9777e579d83a541a79689c990be5d8ecdf4bfe5d2fcf28b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD554a135d28b06e59bce3f7f25f053312d
SHA1613156aa89a91727266dc725d06286f582e6d91a
SHA2568f5dfc2121938aae37986a08d36e7556276012122d3312a95ca74023e00d453d
SHA5129f74a6062d30a11c0879929dbe757645f3e207f1ca37a2d31e07b32f856f8568061e51bf2deaa831d9777e579d83a541a79689c990be5d8ecdf4bfe5d2fcf28b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD554a135d28b06e59bce3f7f25f053312d
SHA1613156aa89a91727266dc725d06286f582e6d91a
SHA2568f5dfc2121938aae37986a08d36e7556276012122d3312a95ca74023e00d453d
SHA5129f74a6062d30a11c0879929dbe757645f3e207f1ca37a2d31e07b32f856f8568061e51bf2deaa831d9777e579d83a541a79689c990be5d8ecdf4bfe5d2fcf28b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD554a135d28b06e59bce3f7f25f053312d
SHA1613156aa89a91727266dc725d06286f582e6d91a
SHA2568f5dfc2121938aae37986a08d36e7556276012122d3312a95ca74023e00d453d
SHA5129f74a6062d30a11c0879929dbe757645f3e207f1ca37a2d31e07b32f856f8568061e51bf2deaa831d9777e579d83a541a79689c990be5d8ecdf4bfe5d2fcf28b